CVE-2026-22665

HIGH

8.1

Description

prompts.chat prior to commit 1464475 contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic username resolution to impersonate victim accounts, replace profile content on canonical URLs, and inject attacker-controlled metadata and content across the platform.

CVE Details

CVSS v3.1 Score8.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published4/3/2026

Last Modified4/3/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-178

References

https://github.com/f/prompts.chat/commit/1464475df2698fb7ccd0cdbc382b0750466f891d(disclosure@vulncheck.com)

https://github.com/f/prompts.chat/pull/1098(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/prompts-chat-identity-confusion-via-case-sensitive-username-handling(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.